Jump to content

searchqu search bar problem removing


Recommended Posts

hi

i scanned my computer with the old version of emisisoft anti-malware (updated to latest definitions) it came up that i had searchqu. i restarted the computer as instructed and did another scan just to make sure it had been removed.it had

i checked on the top of IE9 right clicked and it was still there but not ticked. i did a search and found that it is bundled with ilivid which i uninstalled, i then uninstalled searchqu from programs and features-when i did this 2 things happened, zone alarm free stopped a connection to the internet saying that searchqu was trying to transmit a library somewhere on the net it tried to transmit about 3 times . the second thing was that avast free said that searchqu was trying to alter files within the OS-it stopped this. searchqu did unistall eventually (or appear to)

i checked on the top of ie9 and right clicked and searchqu was still there but again with no tick-out of curiosity i ticked it and it said do you want to enable this add on and underneath it said searchqu toolbar (not available) i enabled it and again there was no tick next to searchqu, so i right clicked again and it said do you want to disable this toolbar and underneath it said searchqu toolbar (not available)on searchqu there was still there with no tick.

what i want to know is if it has been removed by emisisoft anti-malware (because it says not available) or could it still be active?

i ran a full scan with the latest version of emisisoft anti-malware (latest updates) and it detected no threats

thanks for any help,

regards,

ken.

Link to post
Share on other sites

Hi,

Please download and run ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows Vista as your operating system right-click the executable and Run as Administrator.

----------

Run OTL.exe

  • Copy/paste the following text written inside of the quote box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services
    :OTL
    IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-re...q={searchTerms}
    IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-re...q={searchTerms}
    IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
    IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-re...q={searchTerms}
    IE - HKCU\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = http://uk.ask.com/we...il&geo=GB&ver=5
    O2:64bit: - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\BrowserConnection.dll (Bandoo Media, inc)
    O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll File not found
    O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\SEARCH~1\Datamngr\BROWSE~1.DLL File not found
    O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll File not found
    O4 - HKLM..\Run: [DATAMNGR] C:\PROGRA~2\SEARCH~1\Datamngr\DATAMN~1.EXE File not found
    O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\x64\datamngr.dll) - File not found
    O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\x64\IEBHO.dll) - File not found
    O20 - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\datamngr.dll) - File not found
    O20 - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\IEBHO.dll) - File not found
    O33 - MountPoints2\{7e4dfa5f-9f7f-11e1-bb56-00269ec3cf49}\Shell - "" = AutoRun
    O33 - MountPoints2\{7e4dfa5f-9f7f-11e1-bb56-00269ec3cf49}\Shell\AutoRun\command - "" = F:\setup.exe
    O33 - MountPoints2\{8cb0b07d-aa6d-11e1-8856-00269ec3cf49}\Shell - "" = AutoRun
    O33 - MountPoints2\{8cb0b07d-aa6d-11e1-8856-00269ec3cf49}\Shell\AutoRun\command - "" = F:\setup.exe
    :Files
    ipconfig /flushdns /c
    :Commands
    [emptytemp]
    [resethosts]
    [start explorer]
    [Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then run a new scan and attach a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

----------

Link to post
Share on other sites

hi

not sure if i did everything right- i ran OTL run fix with lop check and parity check both checked then restarted and did a new scan with lop check and parity check both unchecked.

i only got 1 file, OTL which i have attached.

the searchqu option on the selection at the top of the browser has vanished!

thanks very much for your time,

regards,

ken.

Link to post
Share on other sites

Hi,

I see that your Java software is out of date. Please go to Start >> Control Panel >> Programs and Features >> uninstall all versions of Java.

Now download and install the newest version from here >> http://java.com/en/download/index.jsp

-------------

Clear Java Cache

See this page for instructions on how to clear java's cache.

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)

  • Under Temporary Internet Files, click the Delete Files button.
  • There are three options in the window to clear the cache - Leave ALL 3 Checked

    • Downloaded Applets
      Downloaded Applications
      Other Files

    [*]Click OK on Delete Temporary Files Window

    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.

    [*]Click OK to leave the Java Control Panel.

----------

Malwarebytes

I see that you have Malwarebytes already on your computer. Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.

----------

ESET Online Scanner

Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator

  • Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file..."
  • Save that text file on your desktop. Attach the contents of that log as a reply to this topic.
  • Close the ESET online scan, and let me know how things are now.

----------

Attach the logs made by Malwarebytes and ESET and let me know how your system is running.

Link to post
Share on other sites

hello again!

i have installed and run pctools yesterday please find attached its history log and the other 2 you requested.

yontoo is listed on programs/features (installed 1/10/2012). i don't remember installing anything that this could have been bundled with!

many thanks for the ongoing support,

regards,

ken

Link to post
Share on other sites

Hi,

Looks pretty good. How is your system running? :)

Run OTL.exe

  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
    :Services
    
    :Files
    C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage2.zip
    C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
    
    :Commands
    [purity]
    [resethosts]
    [emptytemp]
    [clearallrestorepoints]
    [start explorer]
    [Reboot]


  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then run a new scan and attach a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Link to post
Share on other sites

hi

my system is running fine thanks but i'm a bit worried by the threats in the history of pctools.

i ran fix with OTL I checked lop check and purity but it got interupted by pctools because it detected that OTL was changing dll or something- i allowed it and ticked box so it would remember, it rebooted i checked the log (attached) and it has an error (maybe caused by the interuption?)

should i do the whole thing again?

regards,

ken.

Link to post
Share on other sites

hi

my compters running fine! its just a couple of entries in pctools history:

Threat Name - Spyware.Known_Bad_Sites

Details - Site Guard has blocked access to a bad website

Risk Level - High

Infection - ad.bnmla.com (67.217.168.212)

Infection was detected on this computer

Threat Name - Spyware.Known_Bad_Sites

Type - Internet Temporary File

Risk Level - High

Infection - - http://ad.bnmla.com/...865&noe=1=

04/10/2012 18:06:28:341

also yontoo is still listed under programs/features should i just unistall it?

thanks,

regards,

ken.

Link to post
Share on other sites
its just a couple of entries in pctools history
This is just what PCTools is blocking. It is not showing an active infection on your system but that the web site is possibly bad.

Yes you can go ahead and uninstall Yontoo from Control Panel >> Programs and Features

Other than that, I think that you should be good to go if there are no more problems. :) When you let me know we can clean up our tools.

Link to post
Share on other sites

hi

please forgive my ignorance but i did not try to connect to this bad website and was thinking that something inside my computer was trying to connect to it.

do you think i will be safe to use my credit cards and online banking sites safely now on this machine? i am a bit paranoid because i have been the subject of credit card fraud in the past a couple of times even though i have only used them on safe sites!

i think it is ok for you to clean up, thank you very much for your indepth assistance and i will definitely be recommending your product to my friends.

regards,

ken

Link to post
Share on other sites

hi

i can't uninstall yontoo zonealarms came up with endless repeated warnings that yontoo was dispalying suspicious behaviour-it never stopped until i cancelled the uninstall. firstly it said tam installer is trying to communicate with c:\windows\system32\taskhost.exe by opening its process, this went on and on listing different programs from my computer.

please help.

regards,

ken

Link to post
Share on other sites

Ok....let's get another look....

Please download DDS from either of these links

LINK 1

LINK 2

and save it to your desktop.

  • Disable any script blocking protection
  • Right-click and Run as Administrator dds to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.

---------------------------------------------------

Please attach the following in your next reply:

DDS.txt

Attach.txt

----------

Link to post
Share on other sites

hi

more problems!

while trying to download from link 1 zonealarm browser security reported "the files content layout and format resembles that of malicious software"

i know you wouldn't try to send me any malware but just in case the link has been hijacked i want to check that its just because it probably contains virus defintions that ZA thinks is a threat.

just to update you after trying to uninstall zondoo i tried to uninstall adobe reader (because i read that it can harbour malicious code) it wouldn't let me. is this suspect? it said "the windows installer service could not be accessed this can occur if the windows installer is not correctly installed"

i needed to uninstall then reinstall emsisoft because when pctools did a scan avast quarantined files from emsisoft,that pctools was scanning at the time (which i couldn't restore from avasts quarantine) when i tried to reinstall emsisoft it wouldn't let me it said that emsisoft was still installed-as if the unistaller was had not worked properly.this is the first time i've had problems uninstalling programs.

please advise,

regards,

ken

Link to post
Share on other sites

hi

just to check- i have disabled anything to do with scripting on IE and firefox, after running DDS i have restet them. i could not find any script blocking stuff in any of my anti-malware software.

please find attached the files you requested.

thanks,

regards,

ken.

Link to post
Share on other sites

Hi,

I notice that you have both Avast and PCTools running at the same time. Having more than one antivirus program running at the same time can seriously degrade the performance of your system. Please uninstall either Avast or PCTools (which ever you prefer) using either the provided uninstall feature that is part of the antivirus program or through Add/Remove Programs (for Vista and Win 7 users to go to Programs and Features in the Control Panel). As a rule of thumb one should run one firewall, one antivirus program in memory, and one antispyware utility in memory. It's fine to have other security tools available on an as-needed or on-demand basis, but when multiple tools simultaneously perform the same function, you're asking for trouble.

You also have two firewalls on your system being ran by PCTools and ZoneAlarm.

With configuration I would actually recommend the following but you can decide what is best.... if it were my system I would run only Avast and use the Windows 7 firewall and remove the rest.

Once you get that finished please run a new scan with DDS and attach the new log created.

Link to post
Share on other sites

hi

i do not want to remove pctools after your advice i want it to do request scans only, i have disabled everything else including its firewall.

in the future i want to run emsisoft as my AV(scrapping avast) ZA and malwarebytes (paid for) using spybot and pctools to run extra scans (pctools on request not scheduled) do you think this is ok? or would you use AVG free instead of malware bytes?also pctools has host protection is this good or would i better using hostsman?

thanks a lot

regards,

ken

Link to post
Share on other sites

Hi,

in the future i want to run emsisoft as my AV(scrapping avast) ZA and malwarebytes (paid for) using spybot and pctools to run extra scans (pctools on request not scheduled) do you think this is ok? or would you use AVG free instead of malware bytes?also pctools has host protection is this good or would i better using hostsman?
I see that avast is still showing in your DDS log? Did you remove that after you ran DDS?

I would not use AVG instead of Malwarebytes (or at all). AVG is an antivirus program and Malwarebytes is an antimalware program...they actually do different things.

With PCTools having a hosts protection I would just stick with that (I don't use any at all). Truthfully I only run one antivirus (with firewall) and Malwarebytes.

----------

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the box below:

    ClearJavaCache::
    DDS::
    uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
    BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
    TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
    mRun: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
    BHO-X64: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
    BHO-X64: Ask Toolbar BHO - No File
    TB-X64: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
    Firefox::
    FF - ProfilePath - C:\Users\hp\AppData\Roaming\Mozilla\Firefox\Profiles\mo67fojz.default\
    FF - prefs.js: browser.search.selectedEngine - Ask.com
    FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ORJ&o=&locale=&apn_uid=C6D93083-C04E-40C6-8F4C-9C9CE91D49EB&apn_ptnrs=&apn_sauid=6ABF12C8-DC75-467E-A9AD-5EEA26C25DD5&apn_dtid=OSJ000&&q=
    File::
    C:\Program Files (x86)\Ask.com\Updater\Updater.exe
    Folder::
    C:\Program Files (x86)\Ask.com
    C:\ProgramData\Ask
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
    CFScriptB-4.gif
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix may request an update; please allow it.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Attach the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

----------

Link to post
Share on other sites

hi,

i followed you instructions precisely when i dropped the text file onto the cat all that happened was that the text file opened-nothing else,i waited for a couple of minutes and still nothing happened.

i thought that maybe i was meant to download the application but when i clicked on it or rightclicked nothing happened.

please advise,

regards,

ken

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...